12 ms·

Facebook Tries to Make Violations of Terms of Use Into Criminal Violations

340 points by there 17y ago

cookiecaper 17y ago
This is interesting I guess as I've been considering scraping pieces of Facebook recently. They are crazy.
dalore 17y ago
So is using facebook's API to access facebook against the TOS?
jlangenauer 17y ago
So, when Facebook asked for our email account credentials so that it could scrape our address books, that would also count as "criminal trespass"? Breathtaking hypocrisy.
- ErrantX 17y ago
  Well it depends if googlemail et al disallow automating access in their terms (I don't believe they do). Clearly very douchey thought.
  - detst 17y ago
    http://code.google.com/apis/contacts/ http://code.google.com/apis/contacts/ I have no idea if they use this for gmail or similar methods for other services.
    - papachito 17y ago
      They were not, this is relatively new.
      - bruceboughton 17y ago
        Not that new.
- gizmomagico 17y ago
  Incidentally, I joined Facebook in maybe February or March this year, and typed in my GMail -address when registering. Right away I was presented with suggestions for people on Facebook that I might know, and they were obviously scraped from my GMail account. So, as far as I could tell, Facebook got access to my GMail account without ever asking me anything about it.
  - vpdn 17y ago
    Another reason this could happen: Your friends have allowed facebook to scan their accounts and facebook remembered that your friend sent you an email before to the address you're now using to sign up. No scanning of your account required. I'm pretty sure they do save email data of non registered "users" because I was invited to facebook a few times. There was nothing strange on the first invite, but every consecutive invite had other additional friends of mine, who are too "waiting for me" to join.
    - gizmomagico 16y ago
      Sorry for not noticing your reply sooner! Actually the one who invited me and "caused" me to join was someone I didn't really know, but met once at an event. This person was extremely unlikely to be friends with any of my real friends. But still, I got suggestions for my actual friends right away, so I still can't see any other way than for Facebook to actually have had access to my GMail account prior to me joining.
catfish 17y ago
http://news.ycombinator.com/item?id=1291871 http://news.ycombinator.com/item?id=1291871 How timely this post by sushi!!!!
mdasen 17y ago
Considering that Facebook has asked for my email username and password in order to scrape the contacts from my email, this seems hypocritical. So, it's ok for Facebook to scrape data from other sites since that's data going into Facebook (per the user's wishes), but it isn't ok for other sites to scrape Facebook data (per the user's wishes).
- what 17y ago
  I thought everything Zuckerberg ever built was based on scraping other peoples' data. Even now, didn't they pull info from Wikipedia for their pages about your interests?
  - sp332 17y ago
    That's not against Wikipedia's ToS.
    - what 17y ago
      Ok, I've never read their terms of service, until now. I'm guessing they have provided credit to the actual authors with a link to the original article and included a licensing notice? (not on Facebook)
      - ErrantX 17y ago
        Yes, they do link the the Wikipedia article, authors page and the Wikipedia front page.
      - neilk 17y ago
        Wikipedia's Terms of Use basically just guide you to act in a manner compatible with the Creative Commons Attribution / Share-Alike license, as well as the earlier GFDL license. (I am not a lawyer, probably there are significant additions, that's just my take on it). http://wikimediafoundation.org/wiki/Terms_of_Use http://wikimediafoundation.org/wiki/Terms_of_Use Facebook could have scraped Wikipedia without asking, but as it happens, there is an agreement in place. I happen to work at the WMF, but don't ask me for more details, I'm not that privy to them. This thread might help. http://www.gossamer-threads.com/lists/wiki/foundation/194087 http://www.gossamer-threads.com/lists/wiki/foundation/194087
deleted 17y ago
[deleted]
DanBlake 17y ago
The scary part is the court may agree. Recently there was a case ( MDY industries vs Blizzard ) in which they argued that because MDY broke the EULA for Blizzard's software, they were no longer authorized to use the software, and in such- copyright infringers. The judge agreed. ( its now on appeal )
- keltex 17y ago
  That's different. It was a civil issue. This is where facebook is trying to make it criminal.
  - DanBlake 17y ago
    I know its different. I was referencing a previous case that held that disobeying EULA terms can have farther reaching claws than simply breach of contract.
TripleD42 17y ago
THE FACEBOOK RAPE POLICE IS GOING TO ARREST YOU FOR POKING TOO MANY GIRLS WITHOUT GETTING POKED BACK
pierrefar 17y ago
Geez facebook. Bye forever. Account not just deactivated, but deleted.
- natrius 17y ago
  That is quite possibly the least effective means of protest I can imagine.
  - jacquesm 17y ago
    According to the corollary of Metcalfe's law it is actually very effective. I think it would read something like "The value of a communications network decreases with the square of the amount of people that have left it".
    - btilly 17y ago
      Can we please stop calling Metcalfe's "law" a law? It makes the exceedingly questionable assumption that we value all possible connections equally. Many different approaches to quantifying the value of networks converge on the much more reasonable estimate that value tends towards n log(n) rather than n*n. See http://spectrum.ieee.org/computing/networks/metcalfes-law-is-wrong/0 http://spectrum.ieee.org/computing/networks/metcalfes-law-is... for more.
      - jacquesm 17y ago
        Nice writing! Ok, we'll call it 'Tillys anything but a law' in stead ;) I think everybody realizes that Metcalfe's law is not a 'law' in the sense that it is a given or an absolute, any of those - including Moores law and others like it are to be taken with a grain of salt. The practical upshot of all this is that if the value of a network goes up with a non-linear factor when the number of participants increases the reverse also holds true. What we call it doesn't really matter and Metcalfe's law will do as good as any other shorthand description that will convey the point. Thanks for the interesting read by the way, it's nice to see that even if Metcalfe was maybe wrong in the 'absolute' in principle the concept of non-linear value increase seems to hold true.
lukev 17y ago
I agree with the EFF 100% in the article. But it's not always so clear. What if I agree to developer Terms of Service that say I can't disseminate users' information, then publish a Identity Theft Target List with information pulled from the Facebook API? Seems like that should be a criminal violation, even though I "only" violated a TOS.
- paulbaumgart 17y ago
  What's an "Identity Theft Target List"? A list of information about people to make identity theft easier? In that case, publishing a list like that should be the crime (if it isn't already), not the TOS violation that got you the data.
  - lukev 17y ago
    Not necessarily. If it's public information that I could obtain by visiting their page, I can't get in trouble for collating it and publishing it. Having access to Facebook's API makes it practical to scrape massive amounts of data, however.
    - paulbaumgart 17y ago
      If the data are public already, you're not really changing much by gathering them in one place. More important is the case of private data that are gathered by having a user enter their credentials. Using the private data in a way to which the user expressly agrees, regardless of TOS, should be legal. The problem arises when the data are used in a way counter to the user's wishes: like pretending to offer social network aggregation and instead publishing it without consent. That should probably be illegal. I agree that it's not so clear-cut. Like a lot of legal matters, intent is also relevant, in addition to the actual effect.
- _delirium 17y ago
  I could see specific kinds of agreement violations being legally enforceable, but it seems safer if it was "opt-in" on the government's part which kinds of agreements can be enforceable that way, as opposed to letting anyone who writes a TOS be able to invent arbitrary new criminal offenses on the fly. For example, there could be a law saying that anyone who disseminates information they agreed to keep private is guilty of an offense. That would make certain kinds of TOS related to information confidentiality legally enforceable. Of course, Facebook might then themselves be guilty of that offense with their retroactive privacy-policy changes...
DanielBMarkham 17y ago
We need about 100 programmers to go out right now and start writing code that allows users to download and update information from their Facebook social graph. Let them fight a hundred legal battles instead of just one. I've seen this coming for some time. There is going to be a war over who owns the data about each person, the person themselves or some service provider. I know that legally the service provider owns it, but I'm not thinking that is the way most people see it. This is a case where the law has gotten very far out of sync with the public (and with the first principles of natural law and personal property, but that's a discussion for another time)
- eru 17y ago
  European law may have a different attitude to "who own the person's data".
- jacquesm 17y ago
  > I know that legally the service provider owns it, but I'm not thinking that is the way most people see it. That's not the way most member states of the EU see it either, they have ruled very clearly that the user owns the data and has the right to access it, amend it and ask for it to be removed at any time.
- tokenadult 17y ago
  One example, Give Me My Data: http://www.facebook.com/apps/application.php?id=206330625089 http://www.facebook.com/apps/application.php?id=206330625089 But, yes, let a hundred flowers bloom in this market space.
- jakx 17y ago
  >We need about 100 programmers to go out right now and start writing code that allows users to download and update information from their Facebook social graph. Why stop there? They could go on and create a sort of alt-Facebook.
  - mkramlich 17y ago
    Let's call it, oh I dunno, "MySpace.com". Oops, just tried it and some squatter has it. Drat!
ajg1977 17y ago
Lately Facebook seem all to happy to trade the goodwill and trust of their users for control and monetization over their data. It's getting a little creepy.
- codexon 17y ago
  They were inevitably headed in that direction. There is no other way to justify their sky-high valuation without exploiting private information.
  - nfnaaron 17y ago
    I'd go farther and guess (guess) that major investors have said something like "well, we invested all this money, now we want major returns." What we've seen would then be reaction to that. And if you're a FB employee, no disrespect to you. If nothing in these posts are true, consider then what FB might be doing wrong so that these kinds of reactions can fester.
- jessriedel 17y ago
  I agree, but the prevalence of FB on the HN front page is a little suspect. There have been at least 10 negative FB posts on HN in the past couple days. I think someone's got an axe to grind...
  - codingthewheel 17y ago
    That someone is "people" and the axe they have to grind is "stop trolling the personal data you unscrupulously collected from us in the first place by hoodwinking us into thinking you actually MEANT the meaningless drivel in your privacy policy."
    - ErrantX 17y ago
      I've not fully kept up with all the stories recently (been busy, I have a pretty open FB account anyway etc..) but as far as I was aware the only really problematic thing (from a privacy perspective) was the new favourites/likes etc. thing where certain things can appear on the "fan" page without you really realising. I wasn't aware of anything else specific that was bending the privacy policy to the limit? Anyone care to fill me in on the TL;DR version? (the social graph, as far as I saw, obeys your privacy settings)
bertm 17y ago
Correct me if I am wrong, this seems like a far leap from what the law was intended to do. The ruling would mean good for Facebook and bad for our society.
sraybell 17y ago
Time to start donating to the EFF. They seem to be the only ones looking out for our rights online... They've surprisingly been on the ball, consistently, when these organizations (especially Facebook), do potentially dangerous things with regards to the separation of civil and criminal, to outright privacy violations.
- hoggle 17y ago
  Those people are the best, I have been admiring them for a long time. http://www.google.com/search?&q=electronic+frontier+foundation+donation http://www.google.com/search?&q=electronic+frontier+foun...
- donaq 17y ago
  I bought a keychain from them when RMS visited KL. :)
kylelibra 17y ago
With all this talk about deleting facebook accounts, has anyone ever considered if it might be more effective to get an account banned? You could spam a bunch of people until you get your account permanently banned, I would think that banned accounts eventually get deleted.
- paulbaumgart 17y ago
  How would it be more effective? I can only see it being more annoying for the people you spam.
- joubert 17y ago
  Reputation
- tokenadult 17y ago
  You could spam a bunch of people until you get your account permanently banned, I would think that banned accounts eventually get deleted. To the contrary, if Facebook is advised by competent lawyers, I would expect them to make banned accounts invisible to the public but to keep them in their business records indefinitely.
what 17y ago
> Facebook claims that Power's tool violates criminal law because Facebook's terms of service ban users from accessing their information through "automatic means." So what is the point of the Open Graph then? Doesn't that allow me to access my information through automatic means or am I misunderstanding something?
- ojbyrne 17y ago
  Having just seen this in some boilerplate terms of use, the phrasing almost always includes the phrase "without our express written consent." Which (assuming they have this clause) they can selectively enforce it.
- apike 17y ago
  It appears they want Open Graph to be used in response to user actions that are explicit and specific to Facebook, rather than behind-the-scenes aggregation or polling of any sort that keeps your data in sync with other services. Quite a fine line.
  - what 17y ago
    Hmmm, so anything goes as long as people still have to go to Facebook.com to get their updates.
ErrantX 17y ago
Let's take a small step back here; just like the anti-Google sentiment that was about a few months back it seems is Facebooks turn to face the fire (mostly their fault). A lot of what they are doing is, at best, ethically unsound or, at worst, privacy invading. In this case I'd say (from initial reading) it sits on the scale slap bang in the middle of "a douchebag thing to do". But. It doesn't feel hypocritical because their argument is that their ToS attempt to deny users the right to access their accounts this way. The Email services, as far as I am aware, that FB scrape either explicitly allow or do not disallow such action. It seems "axe grinding" to bring that into the discussion. Notably this article does not appear to discuss or link to articles about the suit Facebook has filed [meta point: I hate that, it feels sneaky]. It appears (from research) that it is an long running dispute between Power and Facebook. They have also filed Trademark infringements and other stuff against them at the same time (no comment on the general legitimacy of such claims for the moment). I haven't fully digested all the information to have a complete opinion on this but... I think that this is part of Facebook trying to win the wider battle with Power.com, I'm not sure it reflects a deliberate move by them to try and turn ToS violations into criminal violations. However I am definitely in agreement with the EFF that if a potential side effect of any eventual ruling will bring in such criminal elements then it is a bad thing and should be fought. Hopefully when I can actually open all the PDF filings the picture will be clearer :) References (I believe this is the suit being referred to): http://www.niallkennedy.com/blog/2009/01/facebook-vs-power-ventures.html http://www.niallkennedy.com/blog/2009/01/facebook-vs-power-v... http://jolt.law.harvard.edu/digest/9th-circuit/facebook-inc-v-power-ventures-inc http://jolt.law.harvard.edu/digest/9th-circuit/facebook-inc-... http://en.wikipedia.org/wiki/Facebook,_Inc._v._Power_Ventures,_Inc http://en.wikipedia.org/wiki/Facebook,_Inc._v._Power_Venture.... EDIT: amusingly TechCrunch seems to have the best summary of things from last year... http://techcrunch.com/2009/07/09/powercom-countersues-facebook-over-data-portability/ http://techcrunch.com/2009/07/09/powercom-countersues-facebo...
- VBprogrammer 17y ago
  I find in a surprising number of instances today's hacker news is tomorrows mainstream news. If the tech blogs are buzzing with this story today you will often find this as a side story on mainstream news sites (the bbc etc) tomorrow. This will get facebooks attention.
gills 17y ago
Agreement between private parties != legislation. Why is this simple notion mentioned nowhere in the EFF letter?
- pohl 17y ago
  As much as I hate the idea of defending FB, the article clearly mentions California computer crime law, which is legislated, as part of FB's argument. The EFF lawyer knows this, and that's why your inequality wasn't mentioned.
apu 17y ago
I know we have several HN users who work at facebook. Do they: 1. Not care? 2. Not see this happening? 3. Not see anything wrong? 4. Can't do anything? 5. Know the "truth," which is substantially different than that being reported? It seems like one of these ought to be true, and at least in the case of (1-3) should be able to report as much to us.
- krschultz 17y ago
  If I was considering hiring an employee with Facebook on their resume, I'd definitely ask their opinion on these matters. If they didn't see a problem with them they aren't working with me. If they did see a problem and didn't do anything about it, I'd weight that pretty heavily against them.
  - archgoon 17y ago
    What if they said "That's why I'm here."?
- jacquesm 17y ago
  1) they probably do 2) they probably do 3) they probably do 4) that's probably it 5) or even worse! Likely their influence is limited and if they don't toe the company line they'll be 'between jobs' next week or so. Speaking out in public against company policy can get your ass canned in some companies pretty quickly. And some do speak up: http://www.securecomputing.net.au/News/164539,facebook-employee-reports-widespread-privacy-abuses.aspx http://www.securecomputing.net.au/News/164539,facebook-emplo...
- hoggle 17y ago
  If I were working at Facebook this would be the time I would quit. In these times of almost endless opportunities not being able to be working socially responsible while still creating value plus being my own woman/man seems somehow anachronistic to me.
  - pyre 17y ago
    > In these times of almost endless opportunities I think that you forgot to suffix that with "for developers in Silicon Valley." With the high unemployment rates, I presume there are a lot of people that don't have the luxury of tossing a job due to moral/ethical dilemmas.
FluidDjango 17y ago
"Legal Director Cindy Cohn: "If Facebook's legal argument is upheld, it will hobble companies that enable consumer choice, as well a create a massive expansion in the scope of California criminal law.' " Or: it will further open up a toehold for new startups to develop alternatives to Facebook - alternatives that treat their user communities better.
- shadowfox 17y ago
  The trouble is that alternate networks to Facebook need a certain critical mass in order to succeed
  - iamdave 17y ago
    And do so quickly.
pstevensza 17y ago
So what's a viable strategy for complaint? People are used to ignoring EULA's and TOS by now. They just want to use Facebook, comment on photos, join groups, play games and keep in touch with friends and family. They don't see this kind of thing as a violation. As long as they're accessing their information on www.facebook.com (accessed by a Google search), why would this worry Joe Average User? Some will see it as a good thing, as it would be effectively illegal for anyone to aggregate their information outside of Facebook. Most of the people I quiz about Facebook don't know who Mark Zuckerburg is, much less care what he does with their data. What worries me is that the route to the escape hatch is buried ever deeper with each reincarnation of the interface and the privacy settings are more complex and time consuming than configuring a robust PF firewall. I'm also considering switching my marital status from single to married just so that I can see ads that don't have anything to do with hook up sites. I would consider an insider protest, where I splash privacy concerns on my wall in my friend's news feed, but they all know where the hide button is. A more interesting approach would be targeting friend's data from outside the site, building a profile and using it nefariously as an object lesson. I fear though that the net result would be a response along the lines of: "This is why Facebook are making this kind of thing illegal". Ultimately, I think you're forced to vote with the delete button. 400-million people who consider E! Entertainment an educational documentary channel really don't give a hoot. Given the vast amount of government and corporate meddling that they already ignore, this is simply one more thing to add to the pile. I do care about it, I support the EFF with a monthly debit order and I talk to people about the concerns. Many just don't see Facebook's actions as an issue.
hans 17y ago
Some day... that federated social networking channel will sprout up... and each person can host their own identity and friends and silly wall posts on the home workstation. Then we can forget about all the ad spam corporations attempting to jack our shxt.
- hans 17y ago
  This BTW would be the ultimate form of rebellion ...
- derefr 17y ago
  Who would own/host a conversation between you and friend X, you or X? Who would have the right to "delete" it? The point of a social graph is that all the useful information exists on the edges, not at the vertices.
  - hans 17y ago
    Sure, but if you think about it, you can host yourself as a vertice with all these incoming / outgoing / directed or not associations and any available number of key/value stores or open graphs for shared data, which could be negotiated as needed. Services might crop up to provide this. It doesn't have to be all users under 1 roof for the entire internet.
    - hans 17y ago
      And this fB open graph nonsense ... you'd have your own property sheet(s) of namespaced attributes (or semantic triples) and websites can negotiate with you for access. Ultimately no corporation would be able to dictate how your data store can be used. Legally it would be your own data domain from the ground up. Checkout VRM ...
  - gbhn 17y ago
    The same person that own and/or host your email to that person: namely, you and they, and the providers you choose (which may be yourselves).
ajju 17y ago
Shame on you, Facebook.
datums 17y ago
“After discussing the issues with Power.com for about a month without reaching a resolution, we filed a lawsuit to enforce our terms of service, maintain the integrity of our site and to assure our users’ privacy and security are protected,” said Barry Schnitt, a Facebook spokesman. What ?? source http://bits.blogs.nytimes.com/2009/01/02/facebook-sues-powercom/ http://bits.blogs.nytimes.com/2009/01/02/facebook-sues-power...
alexyim 17y ago
Facebook is pretty evil.
thentic 17y ago
Given that privacy policies and TOS change on most websites, is there any merit to a 'bait and switch' argument or anything like that? I remember a recent commenter suggesting there was but didn't see any follow up. Conceptually, there is no contract between FB and its users. It's use at your own will; essentially a one-way deal and therefore cannot be a contract. That said, knowing they monetize our content, can argument be made that our content is 'consideration' and therefore a contract is implied?
wisty 17y ago
Shouldn't consumer protection law render this kind of ToS unenforceable? When car manufacturers tried to ban third-party parts, that was shot down. Surely this could be extended to user data?
nfnaaron 17y ago
gmail TOS: http://www.google.com/accounts/TOS?hl=en http://www.google.com/accounts/TOS?hl=en 6. Your passwords and account security 6.1 You agree and understand that you are responsible for maintaining the confidentiality of passwords associated with any account you use to access the Services. 6.2 Accordingly, you agree that you will be solely responsible to Google for all activities that occur under your account. 6.3 If you become aware of any unauthorized use of your password or of your account, you agree to notify Google immediately at http://www.google.com/support/accounts/bin/answer.py?answer=58585. It's not absolutely clear, but 6.1 says to me "don't give your password to anyone." Whether it's for auto-scraping or not. If I give my password to FB to scrape my contacts, I (but not necessarily FB) have violated 6.1 because my password is no longer confidential. So FB is at least relying on someone (me) violating TOS.
mkramlich 17y ago
I tricked Facebook. When they agreed to give me a profile they implicitly agreed to my own ToS. One of the many many intentionally exotic and arcane terms in my own is that they must give me a new pony every Tuesday. Since it is Tuesday, and I have no new pony, they are in violation. Next comes escalation into full-blown criminal code violation, woohoo!
fareskaram 17y ago
Or what? You'll stop using it? Other people? http://welcome-to-croatia.com/holida...tia-apartments http://welcome-to-croatia.com/holida...tia-apartments
clammer 17y ago
The question isn't weather Facebook's TOS makes sense, but if violating them is criminal. It should be up to facebook to find and ban violators from their system. TOS is not a contract and, even if it were, a contract dispute is a civil case not a criminal one. Comment TOS: Reading my comment is strictly prohibited. Violators will be punished to the fullest extent of the law.
haydenchambers 17y ago
There's no 'like' button for this article.
ilitirit 17y ago
Simple solution: Facebook should just delete the offenders' accounts. If we get enough people to do this then pretty soon we won't have to read about Facebook on HN ever again.
woodson 17y ago
Is there a service that "likes" everything that is suggested, uploads pictures of other people tagged with my name, and tags pictures of me with other names? The way I see it, the only way to continue using facebook for its actual purpose (social interaction??) is to have my data tainted in an (non-machine-detectable) obvious fashion so it becomes useless for most automatic classification/categorization attempts.
th0ma5 17y ago
No access through automated means? Browsers automate HTTP, and hence TCP, and IP fairly completely... I guess I could go a layer lower and do all my facebook through Telnet and manually typing GET / HTTP/1.1 but somehow I would think they would find a way to say that is more automated, or scripted or something. This company must be some kind of commercial threat more than anything, and the lawyers are reaching.

340 points by there 17y ago

cookiecaper 17y ago

This is interesting I guess as I've been considering scraping pieces of Facebook recently. They are crazy.

dalore 17y ago

So is using facebook's API to access facebook against the TOS?

jlangenauer 17y ago

So, when Facebook asked for our email account credentials so that it could scrape our address books, that would also count as "criminal trespass"? Breathtaking hypocrisy.

ErrantX 17y ago
Well it depends if googlemail et al disallow automating access in their terms (I don't believe they do). Clearly very douchey thought.
- detst 17y ago
  http://code.google.com/apis/contacts/ http://code.google.com/apis/contacts/ I have no idea if they use this for gmail or similar methods for other services.
  - papachito 17y ago
    They were not, this is relatively new.
    - bruceboughton 17y ago
      Not that new.
gizmomagico 17y ago
Incidentally, I joined Facebook in maybe February or March this year, and typed in my GMail -address when registering. Right away I was presented with suggestions for people on Facebook that I might know, and they were obviously scraped from my GMail account. So, as far as I could tell, Facebook got access to my GMail account without ever asking me anything about it.
- vpdn 17y ago
  Another reason this could happen: Your friends have allowed facebook to scan their accounts and facebook remembered that your friend sent you an email before to the address you're now using to sign up. No scanning of your account required. I'm pretty sure they do save email data of non registered "users" because I was invited to facebook a few times. There was nothing strange on the first invite, but every consecutive invite had other additional friends of mine, who are too "waiting for me" to join.
  - gizmomagico 16y ago
    Sorry for not noticing your reply sooner! Actually the one who invited me and "caused" me to join was someone I didn't really know, but met once at an event. This person was extremely unlikely to be friends with any of my real friends. But still, I got suggestions for my actual friends right away, so I still can't see any other way than for Facebook to actually have had access to my GMail account prior to me joining.

catfish 17y ago

http://news.ycombinator.com/item?id=1291871 http://news.ycombinator.com/item?id=1291871 How timely this post by sushi!!!!

mdasen 17y ago

Considering that Facebook has asked for my email username and password in order to scrape the contacts from my email, this seems hypocritical. So, it's ok for Facebook to scrape data from other sites since that's data going into Facebook (per the user's wishes), but it isn't ok for other sites to scrape Facebook data (per the user's wishes).

what 17y ago
I thought everything Zuckerberg ever built was based on scraping other peoples' data. Even now, didn't they pull info from Wikipedia for their pages about your interests?
- sp332 17y ago
  That's not against Wikipedia's ToS.
  - what 17y ago
    Ok, I've never read their terms of service, until now. I'm guessing they have provided credit to the actual authors with a link to the original article and included a licensing notice? (not on Facebook)
    - ErrantX 17y ago
      Yes, they do link the the Wikipedia article, authors page and the Wikipedia front page.
    - neilk 17y ago
      Wikipedia's Terms of Use basically just guide you to act in a manner compatible with the Creative Commons Attribution / Share-Alike license, as well as the earlier GFDL license. (I am not a lawyer, probably there are significant additions, that's just my take on it). http://wikimediafoundation.org/wiki/Terms_of_Use http://wikimediafoundation.org/wiki/Terms_of_Use Facebook could have scraped Wikipedia without asking, but as it happens, there is an agreement in place. I happen to work at the WMF, but don't ask me for more details, I'm not that privy to them. This thread might help. http://www.gossamer-threads.com/lists/wiki/foundation/194087 http://www.gossamer-threads.com/lists/wiki/foundation/194087

deleted 17y ago

[deleted]

DanBlake 17y ago

The scary part is the court may agree. Recently there was a case ( MDY industries vs Blizzard ) in which they argued that because MDY broke the EULA for Blizzard's software, they were no longer authorized to use the software, and in such- copyright infringers. The judge agreed. ( its now on appeal )

keltex 17y ago
That's different. It was a civil issue. This is where facebook is trying to make it criminal.
- DanBlake 17y ago
  I know its different. I was referencing a previous case that held that disobeying EULA terms can have farther reaching claws than simply breach of contract.

TripleD42 17y ago

THE FACEBOOK RAPE POLICE IS GOING TO ARREST YOU FOR POKING TOO MANY GIRLS WITHOUT GETTING POKED BACK

pierrefar 17y ago

Geez facebook. Bye forever. Account not just deactivated, but deleted.

natrius 17y ago
That is quite possibly the least effective means of protest I can imagine.
- jacquesm 17y ago
  According to the corollary of Metcalfe's law it is actually very effective. I think it would read something like "The value of a communications network decreases with the square of the amount of people that have left it".
  - btilly 17y ago
    Can we please stop calling Metcalfe's "law" a law? It makes the exceedingly questionable assumption that we value all possible connections equally. Many different approaches to quantifying the value of networks converge on the much more reasonable estimate that value tends towards n log(n) rather than n*n. See http://spectrum.ieee.org/computing/networks/metcalfes-law-is-wrong/0 http://spectrum.ieee.org/computing/networks/metcalfes-law-is... for more.
    - jacquesm 17y ago
      Nice writing! Ok, we'll call it 'Tillys anything but a law' in stead ;) I think everybody realizes that Metcalfe's law is not a 'law' in the sense that it is a given or an absolute, any of those - including Moores law and others like it are to be taken with a grain of salt. The practical upshot of all this is that if the value of a network goes up with a non-linear factor when the number of participants increases the reverse also holds true. What we call it doesn't really matter and Metcalfe's law will do as good as any other shorthand description that will convey the point. Thanks for the interesting read by the way, it's nice to see that even if Metcalfe was maybe wrong in the 'absolute' in principle the concept of non-linear value increase seems to hold true.

lukev 17y ago

I agree with the EFF 100% in the article. But it's not always so clear. What if I agree to developer Terms of Service that say I can't disseminate users' information, then publish a Identity Theft Target List with information pulled from the Facebook API? Seems like that should be a criminal violation, even though I "only" violated a TOS.

paulbaumgart 17y ago
What's an "Identity Theft Target List"? A list of information about people to make identity theft easier? In that case, publishing a list like that should be the crime (if it isn't already), not the TOS violation that got you the data.
- lukev 17y ago
  Not necessarily. If it's public information that I could obtain by visiting their page, I can't get in trouble for collating it and publishing it. Having access to Facebook's API makes it practical to scrape massive amounts of data, however.
  - paulbaumgart 17y ago
    If the data are public already, you're not really changing much by gathering them in one place. More important is the case of private data that are gathered by having a user enter their credentials. Using the private data in a way to which the user expressly agrees, regardless of TOS, should be legal. The problem arises when the data are used in a way counter to the user's wishes: like pretending to offer social network aggregation and instead publishing it without consent. That should probably be illegal. I agree that it's not so clear-cut. Like a lot of legal matters, intent is also relevant, in addition to the actual effect.
_delirium 17y ago
I could see specific kinds of agreement violations being legally enforceable, but it seems safer if it was "opt-in" on the government's part which kinds of agreements can be enforceable that way, as opposed to letting anyone who writes a TOS be able to invent arbitrary new criminal offenses on the fly. For example, there could be a law saying that anyone who disseminates information they agreed to keep private is guilty of an offense. That would make certain kinds of TOS related to information confidentiality legally enforceable. Of course, Facebook might then themselves be guilty of that offense with their retroactive privacy-policy changes...

DanielBMarkham 17y ago

We need about 100 programmers to go out right now and start writing code that allows users to download and update information from their Facebook social graph. Let them fight a hundred legal battles instead of just one. I've seen this coming for some time. There is going to be a war over who owns the data about each person, the person themselves or some service provider. I know that legally the service provider owns it, but I'm not thinking that is the way most people see it. This is a case where the law has gotten very far out of sync with the public (and with the first principles of natural law and personal property, but that's a discussion for another time)

eru 17y ago
European law may have a different attitude to "who own the person's data".
jacquesm 17y ago
> I know that legally the service provider owns it, but I'm not thinking that is the way most people see it. That's not the way most member states of the EU see it either, they have ruled very clearly that the user owns the data and has the right to access it, amend it and ask for it to be removed at any time.
tokenadult 17y ago
One example, Give Me My Data: http://www.facebook.com/apps/application.php?id=206330625089 http://www.facebook.com/apps/application.php?id=206330625089 But, yes, let a hundred flowers bloom in this market space.
jakx 17y ago
>We need about 100 programmers to go out right now and start writing code that allows users to download and update information from their Facebook social graph. Why stop there? They could go on and create a sort of alt-Facebook.
- mkramlich 17y ago
  Let's call it, oh I dunno, "MySpace.com". Oops, just tried it and some squatter has it. Drat!

ajg1977 17y ago

Lately Facebook seem all to happy to trade the goodwill and trust of their users for control and monetization over their data. It's getting a little creepy.

codexon 17y ago
They were inevitably headed in that direction. There is no other way to justify their sky-high valuation without exploiting private information.
- nfnaaron 17y ago
  I'd go farther and guess (guess) that major investors have said something like "well, we invested all this money, now we want major returns." What we've seen would then be reaction to that. And if you're a FB employee, no disrespect to you. If nothing in these posts are true, consider then what FB might be doing wrong so that these kinds of reactions can fester.
jessriedel 17y ago
I agree, but the prevalence of FB on the HN front page is a little suspect. There have been at least 10 negative FB posts on HN in the past couple days. I think someone's got an axe to grind...
- codingthewheel 17y ago
  That someone is "people" and the axe they have to grind is "stop trolling the personal data you unscrupulously collected from us in the first place by hoodwinking us into thinking you actually MEANT the meaningless drivel in your privacy policy."
  - ErrantX 17y ago
    I've not fully kept up with all the stories recently (been busy, I have a pretty open FB account anyway etc..) but as far as I was aware the only really problematic thing (from a privacy perspective) was the new favourites/likes etc. thing where certain things can appear on the "fan" page without you really realising. I wasn't aware of anything else specific that was bending the privacy policy to the limit? Anyone care to fill me in on the TL;DR version? (the social graph, as far as I saw, obeys your privacy settings)

bertm 17y ago

Correct me if I am wrong, this seems like a far leap from what the law was intended to do. The ruling would mean good for Facebook and bad for our society.

sraybell 17y ago

Time to start donating to the EFF. They seem to be the only ones looking out for our rights online... They've surprisingly been on the ball, consistently, when these organizations (especially Facebook), do potentially dangerous things with regards to the separation of civil and criminal, to outright privacy violations.

hoggle 17y ago
Those people are the best, I have been admiring them for a long time. http://www.google.com/search?&q=electronic+frontier+foundation+donation http://www.google.com/search?&q=electronic+frontier+foun...
donaq 17y ago
I bought a keychain from them when RMS visited KL. :)

kylelibra 17y ago

With all this talk about deleting facebook accounts, has anyone ever considered if it might be more effective to get an account banned? You could spam a bunch of people until you get your account permanently banned, I would think that banned accounts eventually get deleted.

paulbaumgart 17y ago
How would it be more effective? I can only see it being more annoying for the people you spam.
joubert 17y ago
Reputation
tokenadult 17y ago
You could spam a bunch of people until you get your account permanently banned, I would think that banned accounts eventually get deleted. To the contrary, if Facebook is advised by competent lawyers, I would expect them to make banned accounts invisible to the public but to keep them in their business records indefinitely.

what 17y ago

> Facebook claims that Power's tool violates criminal law because Facebook's terms of service ban users from accessing their information through "automatic means." So what is the point of the Open Graph then? Doesn't that allow me to access my information through automatic means or am I misunderstanding something?

ojbyrne 17y ago
Having just seen this in some boilerplate terms of use, the phrasing almost always includes the phrase "without our express written consent." Which (assuming they have this clause) they can selectively enforce it.
apike 17y ago
It appears they want Open Graph to be used in response to user actions that are explicit and specific to Facebook, rather than behind-the-scenes aggregation or polling of any sort that keeps your data in sync with other services. Quite a fine line.
- what 17y ago
  Hmmm, so anything goes as long as people still have to go to Facebook.com to get their updates.

ErrantX 17y ago

Let's take a small step back here; just like the anti-Google sentiment that was about a few months back it seems is Facebooks turn to face the fire (mostly their fault). A lot of what they are doing is, at best, ethically unsound or, at worst, privacy invading. In this case I'd say (from initial reading) it sits on the scale slap bang in the middle of "a douchebag thing to do". But. It doesn't feel hypocritical because their argument is that their ToS attempt to deny users the right to access their accounts this way. The Email services, as far as I am aware, that FB scrape either explicitly allow or do not disallow such action. It seems "axe grinding" to bring that into the discussion. Notably this article does not appear to discuss or link to articles about the suit Facebook has filed [meta point: I hate that, it feels sneaky]. It appears (from research) that it is an long running dispute between Power and Facebook. They have also filed Trademark infringements and other stuff against them at the same time (no comment on the general legitimacy of such claims for the moment). I haven't fully digested all the information to have a complete opinion on this but... I think that this is part of Facebook trying to win the wider battle with Power.com, I'm not sure it reflects a deliberate move by them to try and turn ToS violations into criminal violations. However I am definitely in agreement with the EFF that if a potential side effect of any eventual ruling will bring in such criminal elements then it is a bad thing and should be fought. Hopefully when I can actually open all the PDF filings the picture will be clearer :) References (I believe this is the suit being referred to): http://www.niallkennedy.com/blog/2009/01/facebook-vs-power-ventures.html http://www.niallkennedy.com/blog/2009/01/facebook-vs-power-v... http://jolt.law.harvard.edu/digest/9th-circuit/facebook-inc-v-power-ventures-inc http://jolt.law.harvard.edu/digest/9th-circuit/facebook-inc-... http://en.wikipedia.org/wiki/Facebook,_Inc._v._Power_Ventures,_Inc http://en.wikipedia.org/wiki/Facebook,_Inc._v._Power_Venture.... EDIT: amusingly TechCrunch seems to have the best summary of things from last year... http://techcrunch.com/2009/07/09/powercom-countersues-facebook-over-data-portability/ http://techcrunch.com/2009/07/09/powercom-countersues-facebo...

VBprogrammer 17y ago
I find in a surprising number of instances today's hacker news is tomorrows mainstream news. If the tech blogs are buzzing with this story today you will often find this as a side story on mainstream news sites (the bbc etc) tomorrow. This will get facebooks attention.

gills 17y ago

Agreement between private parties != legislation. Why is this simple notion mentioned nowhere in the EFF letter?

pohl 17y ago
As much as I hate the idea of defending FB, the article clearly mentions California computer crime law, which is legislated, as part of FB's argument. The EFF lawyer knows this, and that's why your inequality wasn't mentioned.

apu 17y ago

I know we have several HN users who work at facebook. Do they: 1. Not care? 2. Not see this happening? 3. Not see anything wrong? 4. Can't do anything? 5. Know the "truth," which is substantially different than that being reported? It seems like one of these ought to be true, and at least in the case of (1-3) should be able to report as much to us.

krschultz 17y ago
If I was considering hiring an employee with Facebook on their resume, I'd definitely ask their opinion on these matters. If they didn't see a problem with them they aren't working with me. If they did see a problem and didn't do anything about it, I'd weight that pretty heavily against them.
- archgoon 17y ago
  What if they said "That's why I'm here."?
jacquesm 17y ago
1) they probably do 2) they probably do 3) they probably do 4) that's probably it 5) or even worse! Likely their influence is limited and if they don't toe the company line they'll be 'between jobs' next week or so. Speaking out in public against company policy can get your ass canned in some companies pretty quickly. And some do speak up: http://www.securecomputing.net.au/News/164539,facebook-employee-reports-widespread-privacy-abuses.aspx http://www.securecomputing.net.au/News/164539,facebook-emplo...
hoggle 17y ago
If I were working at Facebook this would be the time I would quit. In these times of almost endless opportunities not being able to be working socially responsible while still creating value plus being my own woman/man seems somehow anachronistic to me.
- pyre 17y ago
  > In these times of almost endless opportunities I think that you forgot to suffix that with "for developers in Silicon Valley." With the high unemployment rates, I presume there are a lot of people that don't have the luxury of tossing a job due to moral/ethical dilemmas.

FluidDjango 17y ago

"Legal Director Cindy Cohn: "If Facebook's legal argument is upheld, it will hobble companies that enable consumer choice, as well a create a massive expansion in the scope of California criminal law.' " Or: it will further open up a toehold for new startups to develop alternatives to Facebook - alternatives that treat their user communities better.

shadowfox 17y ago
The trouble is that alternate networks to Facebook need a certain critical mass in order to succeed
- iamdave 17y ago
  And do so quickly.

pstevensza 17y ago

So what's a viable strategy for complaint? People are used to ignoring EULA's and TOS by now. They just want to use Facebook, comment on photos, join groups, play games and keep in touch with friends and family. They don't see this kind of thing as a violation. As long as they're accessing their information on www.facebook.com (accessed by a Google search), why would this worry Joe Average User? Some will see it as a good thing, as it would be effectively illegal for anyone to aggregate their information outside of Facebook. Most of the people I quiz about Facebook don't know who Mark Zuckerburg is, much less care what he does with their data. What worries me is that the route to the escape hatch is buried ever deeper with each reincarnation of the interface and the privacy settings are more complex and time consuming than configuring a robust PF firewall. I'm also considering switching my marital status from single to married just so that I can see ads that don't have anything to do with hook up sites. I would consider an insider protest, where I splash privacy concerns on my wall in my friend's news feed, but they all know where the hide button is. A more interesting approach would be targeting friend's data from outside the site, building a profile and using it nefariously as an object lesson. I fear though that the net result would be a response along the lines of: "This is why Facebook are making this kind of thing illegal". Ultimately, I think you're forced to vote with the delete button. 400-million people who consider E! Entertainment an educational documentary channel really don't give a hoot. Given the vast amount of government and corporate meddling that they already ignore, this is simply one more thing to add to the pile. I do care about it, I support the EFF with a monthly debit order and I talk to people about the concerns. Many just don't see Facebook's actions as an issue.

hans 17y ago

Some day... that federated social networking channel will sprout up... and each person can host their own identity and friends and silly wall posts on the home workstation. Then we can forget about all the ad spam corporations attempting to jack our shxt.

hans 17y ago
This BTW would be the ultimate form of rebellion ...
derefr 17y ago
Who would own/host a conversation between you and friend X, you or X? Who would have the right to "delete" it? The point of a social graph is that all the useful information exists on the edges, not at the vertices.
- hans 17y ago
  Sure, but if you think about it, you can host yourself as a vertice with all these incoming / outgoing / directed or not associations and any available number of key/value stores or open graphs for shared data, which could be negotiated as needed. Services might crop up to provide this. It doesn't have to be all users under 1 roof for the entire internet.
  - hans 17y ago
    And this fB open graph nonsense ... you'd have your own property sheet(s) of namespaced attributes (or semantic triples) and websites can negotiate with you for access. Ultimately no corporation would be able to dictate how your data store can be used. Legally it would be your own data domain from the ground up. Checkout VRM ...
- gbhn 17y ago
  The same person that own and/or host your email to that person: namely, you and they, and the providers you choose (which may be yourselves).

ajju 17y ago

Shame on you, Facebook.

datums 17y ago

“After discussing the issues with Power.com for about a month without reaching a resolution, we filed a lawsuit to enforce our terms of service, maintain the integrity of our site and to assure our users’ privacy and security are protected,” said Barry Schnitt, a Facebook spokesman. What ?? source http://bits.blogs.nytimes.com/2009/01/02/facebook-sues-powercom/ http://bits.blogs.nytimes.com/2009/01/02/facebook-sues-power...

alexyim 17y ago

Facebook is pretty evil.

thentic 17y ago

Given that privacy policies and TOS change on most websites, is there any merit to a 'bait and switch' argument or anything like that? I remember a recent commenter suggesting there was but didn't see any follow up. Conceptually, there is no contract between FB and its users. It's use at your own will; essentially a one-way deal and therefore cannot be a contract. That said, knowing they monetize our content, can argument be made that our content is 'consideration' and therefore a contract is implied?

wisty 17y ago

Shouldn't consumer protection law render this kind of ToS unenforceable? When car manufacturers tried to ban third-party parts, that was shot down. Surely this could be extended to user data?

nfnaaron 17y ago

gmail TOS: http://www.google.com/accounts/TOS?hl=en http://www.google.com/accounts/TOS?hl=en 6. Your passwords and account security 6.1 You agree and understand that you are responsible for maintaining the confidentiality of passwords associated with any account you use to access the Services. 6.2 Accordingly, you agree that you will be solely responsible to Google for all activities that occur under your account. 6.3 If you become aware of any unauthorized use of your password or of your account, you agree to notify Google immediately at http://www.google.com/support/accounts/bin/answer.py?answer=58585. It's not absolutely clear, but 6.1 says to me "don't give your password to anyone." Whether it's for auto-scraping or not. If I give my password to FB to scrape my contacts, I (but not necessarily FB) have violated 6.1 because my password is no longer confidential. So FB is at least relying on someone (me) violating TOS.

mkramlich 17y ago

I tricked Facebook. When they agreed to give me a profile they implicitly agreed to my own ToS. One of the many many intentionally exotic and arcane terms in my own is that they must give me a new pony every Tuesday. Since it is Tuesday, and I have no new pony, they are in violation. Next comes escalation into full-blown criminal code violation, woohoo!

fareskaram 17y ago

Or what? You'll stop using it? Other people? http://welcome-to-croatia.com/holida...tia-apartments http://welcome-to-croatia.com/holida...tia-apartments

clammer 17y ago

The question isn't weather Facebook's TOS makes sense, but if violating them is criminal. It should be up to facebook to find and ban violators from their system. TOS is not a contract and, even if it were, a contract dispute is a civil case not a criminal one. Comment TOS: Reading my comment is strictly prohibited. Violators will be punished to the fullest extent of the law.

haydenchambers 17y ago

There's no 'like' button for this article.

ilitirit 17y ago

Simple solution: Facebook should just delete the offenders' accounts. If we get enough people to do this then pretty soon we won't have to read about Facebook on HN ever again.

woodson 17y ago

Is there a service that "likes" everything that is suggested, uploads pictures of other people tagged with my name, and tags pictures of me with other names? The way I see it, the only way to continue using facebook for its actual purpose (social interaction??) is to have my data tainted in an (non-machine-detectable) obvious fashion so it becomes useless for most automatic classification/categorization attempts.

th0ma5 17y ago

No access through automated means? Browsers automate HTTP, and hence TCP, and IP fairly completely... I guess I could go a layer lower and do all my facebook through Telnet and manually typing GET / HTTP/1.1 but somehow I would think they would find a way to say that is more automated, or scripted or something. This company must be some kind of commercial threat more than anything, and the lawyers are reaching.